CVE-2026-104733: User Impersonation/Authorization Bypass in XMPP Server ejabberd
Published Oct 2, 2026
·Updated
User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.
Affected Software
1 affected component
ProcessOne ejabberd<=26.04
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ejabberdto a version that resolves this vulnerability.Fixed in 26.07
Event History
Oct 2, 2026
CVE Published
via MITRE·12:19 PM
Data Sourced
via MITRE·12:19 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are in the affected version range?
ProcessOne ejabberd versions 26.04 and earlier are identified as affected.
2
What does an attacker need to abuse this issue?
The issue is triggered through the authzid parameter in the SASL-PLAIN authentication mechanism. The reported weakness is that this parameter is not validated.
3
Is a newer ejabberd release referenced for remediation review?
The supplied references include the ejabberd 26.07 release page. Review that release and the linked advisory to determine the applicable update path for your deployment.